Security & trust
Built like it sits in front of your money
RouteShift is a shared multi-tenant proxy in front of paid provider credentials and a per-team credit ledger. These are the controls that keep one team’s traffic, keys, and spend away from another’s — and keep any single client from exhausting shared capacity.
Your prompts stay yours
RouteShift proxies requests in real time — prompts and completions are not stored. Operational records are sanitized by design: quality verdicts carry provider, model, outcome, and reason code only, never prompt or response text. Cache accounting persists token counts and policy versions, never the cached content’s source text in logs or exports.
Keys that minimize blast radius
Only a SHA-256 hash of an API key is ever stored; the plaintext is shown once at creation and never persisted. Rotation uses a grace window (default 24h, capped at 168h) so you can roll credentials with zero downtime and no indefinitely-valid dual key. Device-flow keys are scoped to inference and read capabilities, and admin automation uses scoped read-only tokens — never the global admin secret in browser-facing code.
Tenancy enforced at every layer
Every billing, key, and rule record carries a team id, and wildcard or missing tenants are rejected — a key or rule can never silently land in a global bucket. Response-cache keys hash the team id into the lookup, so one team can never receive a cache hit built from another team’s request. Demo mode swaps in a fixed sample team so sample data can never leak live tenant data.
Limits that fail closed, not open
Per-team rate limits run on a sliding 60-second window; per-key and team token budgets reserve an estimate before any paid upstream call and reconcile to actual usage after. Daily, weekly, and monthly spend caps admit traffic transactionally — unknown pricing or a ledger failure rejects the request (503) instead of admitting unbilled traffic. Caps report exact codes: 402 with reset_at when a cap is hit, 429 with retry_after for rate and throttle limits.
A hardened network path
All traffic is encrypted in transit via TLS, with Cloudflare in front of both the API and dashboard surfaces. Dashboard production traffic traverses a private tunnel so generated hosting hostnames cannot be used to bypass the edge, and client-IP extraction for unauthenticated routes is gated on an edge-shared secret so forged headers cannot evade per-IP limits.
Nothing vague in your logs
Exact skip, fallback, and error reasons are preserved verbatim from proxy to log to UI — no collapsing into generic buckets. Savings receipts show measured routed cost against your baseline, and budget surfaces label lower-bound figures as lower bounds when historical cost is unknown. What you see is what the ledger recorded.
Questions about data handling? See the privacy policy.
Start routing